WebCore:

WebCore:

        Reviewed by Mitz.

        - fix http://bugs.webkit.org/show_bug.cgi?id=15806
          <rdar://problem/5561626> ASSERT(element->isRadioButton()) fires destroying form elements

        Test: fast/forms/remove-radio-button-assert.html

        * html/HTMLGenericFormElement.cpp: (WebCore::HTMLGenericFormElement::removeFromForm):
        Added protected function to be used by derived classes that need to do the same sort
        of removal from form that's automatically done by the base class in certain circumstances.
        * html/HTMLGenericFormElement.h: Added removeFromForm.

        * html/HTMLInputElement.cpp: (WebCore::HTMLInputElement::~HTMLInputElement):
        Call removeFromForm here so the element is removed before we destroy the HTMLInputElement
        part of this object. By the time we get to the base class's destructor it's too late.
        The problem is specific to radio buttons so we don't have to worry about other classes
        derived from HTMLGenericFormElement.

LayoutTests:

        Reviewed by Mitz.

        - test for http://bugs.webkit.org/show_bug.cgi?id=15806
          <rdar://problem/5561626> ASSERT(element->isRadioButton()) fires destroying form elements

        * fast/forms/remove-radio-button-assert-expected.txt: Added.
        * fast/forms/remove-radio-button-assert.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@27380 268f45cc-cd09-0410-ab3c-d52691b4dbfc